To test this feature, visit your live site.

Palo Alto HA Active-Passive Port-channel-Switch Stack.

Good afternoon, here again asking for your collaboration, thank you very much. Question is it possible to generate a LACP port-channel towards a switch in stack (2 switches).

Well, being active-passive in HA, it would be in the port-channel of the active firewall, a cable goes to an interface of switch 1 of the portchannel and another interface goes to switch two of the port-channel. and in the Passive the physical connections, portchannel with an interface to an interface of switch 1 of the stack and another interface to switch 2 of the stack.

PA-Active====portchannel====------One interface------switch01-stack

PA-Active====portchannel====------another-interface------swtich02-stack

PA-Passive====portchannel====------One interface------switch01-stack

PA-Passive====portchannel====------another-interface------swtich02-stack

If this is feasible, this configuration is supported in Palo Alto.

Thanks in advance, stay tuned, best regards

5 comments

Comments (5)

Reaper

May 04, 2022

technically that should work perfectly

Reaper

May 03, 2022

Yeah that's perfectly possible as long as the switch supports it too

MetgatzGR

May 03, 2022

Replying to

Excellent, thank you very much Reaper, so as long as the other switches, stack, e.g. a Cisco Stack compatible Cross Stack EtherChannel allows it, there would be no problem, with Palo Alto HA Active / Passive.

I imagine then that the question is too much but I will ask it to confirm, by asking the technical feasibility of a port-channel against a Cisco VSS Core Switch VSS ie have a port-channel (2 interfaces, one for each node of the VSS), the Active connected to an interface to node 1 of the VSS and the other interface to Node 2 of the VSS. And the Passive in the same scheme, Passive Firewall, connected to one interface of a VSS Node and the other interface, connected to the other VSS node.

I remain attentive, thanks for the support, collaboration and help.

Reaper

May 03, 2022

Yes, you can create an aggregate HA group and enable lacp You can even enable "lacp in passive mode" so the passive interfaces come online and form lacp peering while the firewall is in an inactive state

MetgatzGR

May 03, 2022

Replying to

A ok, thank you very much Reaper for your prompt reply. But also my doubt is if it is feasible to assemble a port-channel from the Palo Alto-Active, where the port-channel lacp, one of its interfaces and therefore the cabling, one interface of the port-channel goes to different switches, within the same stack. Example the port-channel from the PA one interface to a switch-01 and another interface of the port-channel to the second switch-02 of the stack. Is this supported port-channel against a stack and physically each interface on different switch.

Forum: Forum